LogScale · CQL

CQL Knowledge Base

$

Ready-to-use CQL queries for threat hunting, detection, and SOC triage. Copy, filter, and search in seconds.

154 queries8 categories
Powered bySofistic·created bydarkreitor
K
20queries
PAID

APT WMIC Enumeration: Multiple System Discovery Queries in Same Session

Detects WMIC usage for multiple system enumeration queries within the same user session, documented technique in APT campaigns for asset inventory prior to lateral movement. Differentiates legitimate admins from adversarial operators by query volume and type.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName="wmic.exe"
| CommandLine=/(?i)(process\s+list|os\s+get|computersystem\s+get|nic.*get|share\s+get|startup\s+get|service\s+get|logicaldisk\s+get|useraccount\s+get)/
Threat Huntingwmicapt
Intermediate
PAID

APT Lateral Movement via WMIC with Explicit Remote Node Targeting

Identifies wmic.exe usage with /node: parameter targeting remote hosts other than localhost, a documented APT3 technique for remote command execution and system information gathering in compromised networks

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)wmic\.exe$/
| CommandLine=/(?i)\/node:/
Threat Huntingwmiclateral-movement
Advanced
PAID

Malicious Child Process from Office Application — APT3 Spear-Phishing Pattern

Detects the execution of command interpreters and download tools as child processes of Office and Acrobat applications, an initial access pattern documented in the APT3 profile via spear-phishing with malicious documents that execute macros or embedded exploits to deploy second-stage payloads.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|acrord32\.exe|mspub\.exe|onenote\.exe)/
| FileName=/(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe|regsvr32\.exe|rundll32\.exe)/
Malwareapt3spear-phishing
Intermediate
PAID

System Process with Unauthorized Parent — Hidden Process Hunting

Detects critical Windows processes (svchost, lsass, services, winlogon, csrss, wininit) running from unusual parent processes. A key post-compromise threat hunting technique to identify process injection or masquerading used by advanced actors to hide malware within the system process tree.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(svchost\.exe|lsass\.exe|services\.exe|winlogon\.exe|csrss\.exe|wininit\.exe)/
| not ParentBaseFileName=/(?i)(services\.exe|wininit\.exe|smss\.exe|lsass\.exe|winlogon\.exe|ntoskrnl\.exe)/
Threat Huntinghidden-processprocess-injection
Advanced
PAID

Remote Authentication Spike per Account — Lateral Movement Detection

Detects accounts with more than 8 remote authentications within a 30-minute window, a pattern indicative of automated lateral movement or active use of compromised credentials for host pivoting. Aligned with Falcon Identity Threat Protection capabilities for detecting identity abuse and lateral movement in corporate environments.

#repo="base_sensor" #event_simpleName=UserLogon
| LogonType=/^(3|10)$/
| groupBy([UserName, RemoteAddressIP4, ComputerName], function=[count(as=logon_count), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
Identitylateral-movementcredential-abuse
Advanced
FREE

Registry Run Key Modification for Persistence

Detects writes to Windows Run, RunOnce, and Winlogon registry keys, the most widely used persistence mechanism employed by malware to execute automatically at system startup. Essential for basic post-compromise triage during Incident Response to identify residual persistence artifacts per CrowdStrike best practices.

#repo="base_sensor" #event_simpleName=RegGenericValueUpdate
| RegKeyPath=/(?i)(Software\\Microsoft\\Windows\\CurrentVersion\\Run|Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce|Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon)/
| groupBy([ComputerName, UserName, RegKeyPath, RegValueName, RegStringValue], function=count())
Persistenceregistryrun-key
Beginner
FREE

Scheduled Task Creation with schtasks.exe for Persistence

Detects the use of schtasks.exe to create or modify scheduled tasks, a basic persistence mechanism widely used by malware and attackers to maintain access across system reboots. Essential for basic host triage during Incident Response to identify residual persistence artifacts on compromised endpoints.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)schtasks\.exe/
| CommandLine=/(?i)(\/create|\/sc|\/tr|\/tn)/
Persistencescheduled-taskpersistence
Beginner
PAID

Kernel Driver Loaded from Non-Standard Path — BYOVD Attack

Detects the loading of kernel drivers (.sys) from non-standard paths such as Temp, AppData, or ProgramData. The BYOVD (Bring Your Own Vulnerable Driver) technique enables escalation to kernel level and EDR evasion, particularly relevant given the landscape of critical Windows driver vulnerabilities documented in 2025.

#repo="base_sensor" #event_simpleName=DriverLoad
| ImageFileName=/(?i)\.sys$/
| ImageFileName=/(?i)(\\temp\\|\\tmp\\|\\appdata\\|\\programdata\\|users\\public|\\downloads\\)/
EDRbyovdvulnerable-driver
Intermediate
PAID

APT3 Multi-Stage CMD Reconnaissance Chain Detection

Detects sequences of reconnaissance commands executed via cmd.exe consistent with APT3 operator TTPs — chains of whoami, net user/group, nltest, ipconfig, and systeminfo from the same user on the same host, indicative of hands-on-keyboard activity post-compromise

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)cmd\.exe/
| CommandLine=/(?i)(whoami|net\s+(user|group|localgroup)|nltest|ipconfig|systeminfo|tasklist|netstat|arp|quser)/
Threat Huntingapt3cmd-recon
Advanced
PAID

BYOVD: Kernel Driver Loaded from Non-Standard User Path

Detects the Bring Your Own Vulnerable Driver (BYOVD) attack by identifying kernel driver loads from paths accessible to unprivileged users. A technique documented in the Windows Privilege Escalation 2025 report for escalating to kernel level, disabling EDR including Falcon, and implanting rootkits. Legitimate OS drivers are never loaded from Temp, AppData, or Downloads.

#repo="base_sensor" #event_simpleName=DriverLoad
| ImageFileName=/(?i)(\\Temp\\|\\AppData\\|\\Users\\|\\Downloads\\|\\ProgramData\\)/
| groupBy([ComputerName, ImageFileName, MD5HashData, SHA256HashData], function=count())
Persistencebyovdkernel-driver
Advanced
PAID

ClickFix Initial Access: LOLBINs Spawned from Web Browser

Detects the ClickFix pattern where popular browsers spawn script interpreters or LOLBIN binaries with suspicious arguments. An active initial access technique used by the LeakNet ransomware group: the user pastes malicious clipboard commands believing they are following legitimate support or CAPTCHA instructions.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|brave\.exe|opera\.exe)/
| FileName=/(?i)(mshta\.exe|wscript\.exe|cscript\.exe|powershell\.exe|pwsh\.exe|cmd\.exe|regsvr32\.exe|rundll32\.exe)/
Malwareclickfixinitial-access
Advanced
PAID

ClickFix: Browser-Spawned Scripting Engine for Initial Access

Detects the ClickFix social engineering initial access technique used by LeakNet and other ransomware actors, where attackers use fake browser prompts to trick users into running clipboard-copied commands. Flags scripting engines spawned directly from major web browsers — a high-confidence indicator of clipboard-hijack campaigns

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe|brave\.exe)/
| FileName=/(?i)(mshta\.exe|wscript\.exe|cscript\.exe|powershell\.exe|cmd\.exe)/
Malwareclickfixinitial-access
Intermediate
PAID

Cloud CDR: IAM Privilege Escalation — High-Risk API Operations

Detects sequences of high-risk cloud API calls used in IAM privilege escalation across AWS, Azure, and GCP. Aligned with CrowdStrike Real-Time Cloud Detection & Response capabilities announced in April 2026. Covers the standard cloud attacker playbook: role creation with modified trust relationships, permanent access key generation, attaching permissive policies, and adding users to privileged groups.

#repo="base_sensor" #event_simpleName=CloudApiActivity
| ActionName=/(?i)(CreateRole|AttachRolePolicy|PutUserPolicy|CreateAccessKey|AddUserToGroup|UpdateAssumeRolePolicy|CreateLoginProfile|SetDefaultPolicyVersion|PassRole)/
| groupBy([UserName, SourceIPAddress, CloudProvider, ActionName], function=count())
Cloudcloudiam
Intermediate
PAID

Deno Runtime Abused as Malware Loader (LeakNet TTP)

Detects suspicious execution of the Deno JavaScript runtime outside developer contexts, matching the LeakNet ransomware gang technique of using the open-source Deno runtime as a malware loader for initial access. Flags Deno processes spawned from non-developer parents with execution or network permission flags

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)deno\.exe/
| CommandLine=/(?i)(run|eval|--allow-net|--allow-read|--allow-write|--allow-all|-A\b)/
Malwaredenoleaknet
Advanced
PAID

Deno Runtime as Malware Loader: LeakNet Ransomware Campaign

Detects abuse of the Deno runtime (open-source Node.js alternative) as a malware loading platform, a technique documented in the active LeakNet ransomware campaign. Deno executes remote code with granular permission flags that bypass PowerShell and wscript-based controls. Its presence on corporate endpoints is inherently anomalous.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)deno(\.exe)?$/
| CommandLine=/(?i)(--allow-all|--allow-net|--allow-read|--allow-write|--allow-run|deno eval|deno run http)/
Malwaredenomalware-loader
Intermediate
FREE

Executable Launched from Windows Temp Directory

Detects processes executing from Windows temporary directories — a common indicator of malware droppers, ransomware payload staging, and post-exploitation download-and-execute patterns. Beginner-friendly detection query for initial triage of suspicious execution paths, covering AppData Temp, Windows Temp, and root Temp locations

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ImageFileName=/(?i)(\\Temp\\|\\AppData\\Local\\Temp\\|\\Windows\\Temp\\)/
| not ImageFileName=/(?i)(MsiExec|setup\.exe|install\.exe|update\.exe|deploy)/
Malwaretemp-directorymalware-staging
Beginner
PAID

Web Exploitation: Anomalous Child Process from IIS Worker Process w3wp.exe

Detects deserialization exploitation in ASP.NET applications through anomalous child processes launched by w3wp.exe. Covers CVE-2025-53690 Sitecore ViewState, RCE in React Server Components via Flight protocol, and critical vulnerabilities in Fortra GoAnywhere MFT. High-fidelity indicator: w3wp.exe should never spawn shells or reconnaissance tools in production.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)w3wp\.exe/
| FileName=/(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe|regsvr32\.exe|rundll32\.exe|net\.exe|whoami\.exe|systeminfo\.exe|curl\.exe|wget\.exe)/
Vulnerabilityiisdeserialization
Advanced
FREE

Basic Detection: PowerShell Executed with EncodedCommand Parameter

Fundamental detection query that identifies PowerShell executions with the -EncodedCommand parameter or its abbreviation -enc. A basic but consistent indicator of malicious obfuscation present in most modern ransomware campaigns (LeakNet/ClickFix) and in post-exploitation stages of critical 2025 vulnerabilities. Ideal as a first query for analysts new to CrowdStrike LogScale.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)powershell(\.exe)?$/
| CommandLine=/(?i)(-EncodedCommand|-enc\b)/
EDRpowershellencoded-command
Beginner
FREE

Whoami Execution by Any Parent Process

Basic detection of whoami.exe execution across all endpoints — one of the most common post-compromise enumeration commands used by attackers to identify current user context after initial access. Ideal for beginner threat hunters and SOC analysts building a baseline of identity enumeration activity in LogScale

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)whoami\.exe/
| groupBy([ComputerName, UserName, ParentBaseFileName], function=count(as=whoami_count))
EDRwhoamienumeration
Beginner
PAID

WMI-Spawned Command Shell for APT Lateral Movement

Detects cmd.exe or PowerShell processes spawned by WmiPrvSE.exe and executing reconnaissance, enumeration, or persistence commands — a high-confidence APT lateral movement indicator. WMI-spawned shells running enumeration commands are a persistent hallmark of hands-on-keyboard operators including APT3 and other nation-state actors

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)WmiPrvSE\.exe/
| FileName=/(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe)/
Persistencewmilateral-movement
Intermediate